>From 6c3eaa2da526f5566b0896c408549546d7833129 Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Sat, 17 Aug 2013 13:32:39 +0200 Subject: [PATCH 2/2] Check if hash key refers to right slot --- src/responder/nss/nsssrv_mmap_cache.c | 43 +++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/src/responder/nss/nsssrv_mmap_cache.c b/src/responder/nss/nsssrv_mmap_cache.c index 4afee22486cd45fd9a10d86b0eedc85d677ab5ee..c88d0d8ef6c7aa49632a28479875f630dd03b556 100644 --- a/src/responder/nss/nsssrv_mmap_cache.c +++ b/src/responder/nss/nsssrv_mmap_cache.c @@ -223,6 +223,47 @@ char sss_check_hash_table(struct sss_mc_ctx *mcc) return true; } +char sss_check_hash_table2(struct sss_mc_ctx *mcc) +{ + volatile uint32_t i; + + const uint32_t ht_elems = MC_HT_ELEMS(mcc->ht_size); + uint32_t *hash_table = mcc->hash_table; + + volatile uint32_t slot; + + const uint32_t dt_elems = mcc->dt_size / MC_SLOT_SIZE; + + struct sss_mc_rec * volatile rec; + for (i=0; i= dt_elems) { + EXCEPTION; + } + + rec = MC_SLOT_TO_PTR(mcc->data_table, slot, struct sss_mc_rec); + if ((rec->b1 == MC_INVALID_VAL) || + (rec->b1 != rec->b2)) { + EXCEPTION; + } + + if (!MC_CHECK_RECORD_LENGTH(mcc, rec)) { + EXCEPTION; + } + + if (rec->hash1 != i && rec->hash2 != i ) { + EXCEPTION; + } + } + + /* all tests passed */ + return true; +} + static void sss_mc_add_rec_to_chain(struct sss_mc_ctx *mcc, struct sss_mc_rec *rec, uint32_t hash) @@ -375,6 +416,7 @@ static void sss_mc_invalidate_rec(struct sss_mc_ctx *mcc, MC_LOWER_BARRIER(rec); sync_var += sss_check_hash_table(mcc); + sync_var += sss_check_hash_table2(mcc); (void) backup; /* unused, debug purpose */ } @@ -805,6 +847,7 @@ errno_t sss_mmap_cache_pw_store(struct sss_mc_ctx **_mcc, /* finally chain the rec in the hash table */ sss_mmap_chain_in_rec(mcc, rec); sync_var += sss_check_hash_table(mcc); + sync_var += sss_check_hash_table2(mcc); return EOK; } -- 1.8.3.1